microdao-daarion/services/ai-security-agent/README.md

🤖 AI Security Agent - Intelligent Crypto Miner Detection

AI-powered security agent that uses local LLM (Ollama qwen3:8b) to detect and mitigate cryptocurrency mining malware on NODE1.

Features

🔍 Intelligent Detection

• LLM-powered analysis: Uses Ollama qwen3:8b for contextual threat analysis
• Multi-signal detection: CPU usage, process names, network connections, filesystem
• Known miner signatures: Detects patterns from previous incidents
• Fallback rules: Works even if LLM is unavailable

⚡ Auto-Mitigation

• Automatic response: Kills malicious processes (>70% confidence)
• File cleanup: Removes suspicious executables from /tmp
• Selective action: Manual review for lower confidence threats

📊 Monitoring

• Real-time scanning: Continuous monitoring every 5 minutes
• Smart optimization: Skips LLM analysis if system is clean
• Comprehensive logging: Detailed logs at /var/log/ai-security-agent.log

Known Threats Detected

From previous incidents on NODE1:

Incident #3 (postgres:15-alpine):

• cpioshuf - 1764% CPU
• ipcalcpg_recvlogical - Auto-restart variant
• mysql - 933% CPU

Incident #4 (postgres:16-alpine):

• bzip2egrep - 1694% CPU
• flockresize - 1628% CPU

Common patterns:

• Hidden directories: /tmp/.perf.c/
• Process masquerading: Disguised as postgres, mysql, etc.
• High CPU usage: >1000% (multi-threaded mining)
• Mining pool connections: Ports 3333, 4444, 5555, 7777, 8888, 9999, 14444

Installation

1. Deploy to NODE1

# Copy service to NODE1
scp -r services/ai-security-agent root@144.76.224.179:/opt/microdao-daarion/services/

# SSH to NODE1
ssh root@144.76.224.179

# Navigate to service directory
cd /opt/microdao-daarion/services/ai-security-agent

# Build and start
docker compose up -d --build

2. Verify Deployment

# Check container status
docker ps | grep ai-security-agent

# View logs
docker logs -f ai-security-agent

# Check log file
tail -f logs/ai-security-agent.log

Configuration

Environment variables (in docker-compose.yml):

Variable	Default	Description
OLLAMA_BASE_URL	http://host.docker.internal:11434	Ollama API endpoint
OLLAMA_MODEL	qwen3:8b	LLM model for analysis
CHECK_INTERVAL	300	Scan interval in seconds (5 min)
ALERT_THRESHOLD	0.7	Confidence threshold for auto-mitigation

How It Works

1. Data Collection

Every 5 minutes, the agent collects:

• System load average and CPU usage
• Processes using >50% CPU
• Known miner process names
• Executable files in /tmp (created in last 24h)
• Network connections to suspicious ports

2. Quick Check

If system is clean (load <5, no suspicious activity):

• ✅ Skip LLM analysis
• Log "System clean"
• Wait for next interval

3. LLM Analysis

If suspicious activity detected:

• 🧠 Send metrics to Ollama qwen3:8b
• LLM analyzes with cybersecurity expertise
• Returns JSON with:
  • threat_detected: boolean
  • confidence: 0.0-1.0
  • threat_type: crypto_miner | suspicious_activity | false_positive
  • indicators: List of specific findings
  • recommended_actions: What to do

4. Auto-Mitigation

If confidence >= 70%:

• ⚡ Kill high CPU processes
• ⚡ Kill known miner processes
• ⚡ Remove suspicious /tmp files
• ⚡ Clean /tmp/.perf.c/
• 📝 Log all actions

If confidence < 70%:

• ⚠️ Log for manual review
• No automatic action

5. Fallback Mode

If LLM fails:

• Use rule-based detection
• Check: load average, high CPU, known signatures, /tmp files, network
• Calculate confidence based on multiple indicators

Example Logs

Clean System

[2026-01-10 10:00:00] [INFO] 🔍 Starting security scan...
[2026-01-10 10:00:01] [INFO] ✅ System clean (quick check)

Threat Detected (Low Confidence)

[2026-01-10 10:05:00] [INFO] 🔍 Starting security scan...
[2026-01-10 10:05:01] [INFO] 🧠 Analyzing with AI (suspicious activity detected)...
[2026-01-10 10:05:05] [INFO]    Analysis complete: threat=True, confidence=45%
[2026-01-10 10:05:05] [ALERT] 🚨 THREAT DETECTED (Incident #1)
[2026-01-10 10:05:05] [ALERT]    Confidence: 45%
[2026-01-10 10:05:05] [ALERT]    Type: suspicious_activity
[2026-01-10 10:05:05] [ALERT]    Summary: High CPU process detected but no known signatures
[2026-01-10 10:05:05] [ALERT] ⚠️  Confidence 45% below threshold 70%, manual review recommended

Threat Detected (High Confidence - Auto-Mitigation)

[2026-01-10 10:10:00] [INFO] 🔍 Starting security scan...
[2026-01-10 10:10:01] [INFO] 🧠 Analyzing with AI (suspicious activity detected)...
[2026-01-10 10:10:08] [INFO]    Analysis complete: threat=True, confidence=95%
[2026-01-10 10:10:08] [ALERT] 🚨 THREAT DETECTED (Incident #2)
[2026-01-10 10:10:08] [ALERT]    Confidence: 95%
[2026-01-10 10:10:08] [ALERT]    Type: crypto_miner
[2026-01-10 10:10:08] [ALERT]    Summary: Known miner signature 'bzip2egrep' detected with high CPU
[2026-01-10 10:10:08] [ALERT]    📍 Known miner signature: bzip2egrep (PID 123456)
[2026-01-10 10:10:08] [ALERT]    📍 Suspicious executable: /tmp/.perf.c/bzip2egrep
[2026-01-10 10:10:08] [ALERT]    📍 High CPU usage: 1694%
[2026-01-10 10:10:08] [ALERT] ⚡ EXECUTING AUTO-MITIGATION
[2026-01-10 10:10:08] [ACTION]    Killing known miner PID 123456 (bzip2egrep)
[2026-01-10 10:10:08] [ACTION]    Removing /tmp/.perf.c/bzip2egrep
[2026-01-10 10:10:08] [ACTION]    Cleaning /tmp/.perf.c/
[2026-01-10 10:10:09] [ALERT] ✅ AUTO-MITIGATION COMPLETED

Advantages Over Bash Script

Old Script (/root/monitor_scanning.sh)

• ✅ Simple and fast
• ✅ No dependencies
• ❌ Rule-based only (can miss new variants)
• ❌ No contextual analysis
• ❌ Manual threshold tuning
• ❌ No learning capability

New AI Agent

• ✅ Contextual understanding: LLM analyzes patterns holistically
• ✅ Adaptive: Can detect new miner variants by behavior
• ✅ Confidence scoring: Nuanced threat assessment
• ✅ Detailed explanations: Understands WHY something is suspicious
• ✅ Future-proof: Can be updated with new threat intelligence
• ✅ Fallback safety: Works even if LLM fails

Architecture

┌─────────────────────────────────────────┐
│         NODE1 Host System               │
│                                         │
│  ┌──────────────────────────────────┐  │
│  │  AI Security Agent (Container)   │  │
│  │                                  │  │
│  │  ┌────────────────────────────┐ │  │
│  │  │  1. Metric Collector       │ │  │
│  │  │     - psutil (CPU, procs)  │ │  │
│  │  │     - find (/tmp scan)     │ │  │
│  │  │     - network connections  │ │  │
│  │  └────────────────────────────┘ │  │
│  │            ↓                     │  │
│  │  ┌────────────────────────────┐ │  │
│  │  │  2. Quick Filter           │ │  │
│  │  │     - Skip if clean        │ │  │
│  │  └────────────────────────────┘ │  │
│  │            ↓                     │  │
│  │  ┌────────────────────────────┐ │  │
│  │  │  3. LLM Analyzer           │ │  │
│  │  │     - Ollama qwen3:8b      │←─┼──┼─┐
│  │  │     - Contextual AI        │ │  │ │
│  │  └────────────────────────────┘ │  │ │
│  │            ↓                     │  │ │
│  │  ┌────────────────────────────┐ │  │ │
│  │  │  4. Decision Engine        │ │  │ │
│  │  │     - Confidence threshold │ │  │ │
│  │  └────────────────────────────┘ │  │ │
│  │            ↓                     │  │ │
│  │  ┌────────────────────────────┐ │  │ │
│  │  │  5. Auto-Mitigation        │ │  │ │
│  │  │     - Kill processes       │ │  │ │
│  │  │     - Clean files          │ │  │ │
│  │  └────────────────────────────┘ │  │ │
│  └──────────────────────────────────┘  │ │
│                                         │ │
│  ┌──────────────────────────────────┐  │ │
│  │  Ollama Service                  │  │ │
│  │  localhost:11434                 │◄─┼─┘
│  │  qwen3:8b (8B params)            │  │
│  └──────────────────────────────────┘  │
└─────────────────────────────────────────┘

Monitoring Agent Health

# Check agent status
docker ps | grep ai-security-agent

# View real-time logs
docker logs -f ai-security-agent

# Check log file
tail -f /opt/microdao-daarion/services/ai-security-agent/logs/ai-security-agent.log

# Check resource usage
docker stats ai-security-agent

# Restart if needed
cd /opt/microdao-daarion/services/ai-security-agent
docker compose restart

Troubleshooting

Agent not detecting processes

Issue: Can't see host processes
Fix: Ensure pid: host in docker-compose.yml

Can't kill processes

Issue: Permission denied
Fix: Ensure privileged: true in docker-compose.yml

LLM connection failed

Issue: Can't reach Ollama
Fix: Check OLLAMA_BASE_URL, ensure Ollama is running

curl http://localhost:11434/api/tags

High memory usage

Issue: Agent using >512MB
Fix: Reduce CHECK_INTERVAL or limit num_predict in LLM call

Security Considerations

Privileges

• Agent runs with privileged: true to kill processes
• Has access to host PID namespace
• Can modify host /tmp directory

Mitigation: Agent runs in Docker container with resource limits

False Positives

• Agent requires 70% confidence for auto-kill
• Lower confidence threats logged for manual review
• Legitimate high-CPU processes might be flagged

Mitigation: Adjust ALERT_THRESHOLD, add process whitelist if needed

Future Improvements

• Telegram alerts: Send notifications on threat detection
• Prometheus metrics: Expose threat count, confidence scores
• Process whitelist: Exclude known-good high-CPU processes
• Network blocking: Block mining pool IPs via iptables
• Image scanning: Scan Docker images before they run
• Historical analysis: Track patterns over time
• Multi-node: Extend to NODE2 and NODE3

Contributing

To update threat signatures:

1. Edit KNOWN_MINER_SIGNATURES in security_agent.py
2. Rebuild container: docker compose up -d --build

To adjust detection logic:

1. Modify _fallback_analysis() for rule-based detection
2. Update LLM prompt in analyze_with_llm() for AI analysis

---

Version: 1.0.0
Created: 2026-01-10
Maintained by: DAARION Security Team
Status: ✅ Production Ready